Back to home

    Privacy & Data Policy

    Last updated — March 2026

    No Telemetry

    sbom-tools is a local CLI tool. It does not collect telemetry, usage analytics, crash reports, or phone-home data of any kind. No data leaves your machine unless you explicitly run a command that queries an external API.

    External API Calls

    When you use vulnerability enrichment features (e.g., OSV, KEV), the CLI makes direct HTTPS requests to the respective public APIs (osv.dev, CISA KEV). These requests go straight from your machine to those services — sbom-tools does not proxy, intercept, or log them. Refer to OSV's privacy policy and CISA's privacy policy for how those services handle requests.

    Your SBOMs Stay Local

    SBOMs are parsed and analyzed entirely on your local machine. They are never uploaded, transmitted, or stored by sbom-tools.

    Website

    The sbom.tools website does not use cookies, analytics, tracking pixels, or any form of visitor tracking. No personal data is collected.

    Open Source

    sbom-tools is open source under the MIT + Apache-2.0 dual license. You can audit every line of code at github.com/sbom-tool/sbom-tools.